The Homeland Security Department warned Tuesday about an unusual cybersecurity flaw for one manufacturer\u2019s implantable heart devices that it said could allow hackers to remotely take control of a person\u2019s defibrillator or pacemaker.<\/p>\n
<\/p>\n
Information on the security flaw, identified by researchers at MedSec Holdings in reports months ago, was only formally made public after the manufacturer, St. Jude Medical, made a software repair available Monday. MedSec is a cybersecurity research company that focuses on the health-care industry.<\/p>\n
The government advisory said security patches will be rolled out automatically over months to patients with a device transmitter at home, as long as it is plugged in and connected to the company\u2019s network. The transmitters send heart device data back to medical professionals.<\/p>\n
Abbott Laboratories\u2019 St. Jude said in a statement it was not aware of deaths or injuries caused by the problem. The Food and Drug Administration also said there was no evidence patients were harmed.<\/p>\n
The federal investigation into the problem started in August.<\/p>\n
MedSec CEO Justine Bone said on Twitter that St. Jude\u2019s software fix did not address all problems in the devices.<\/p>\n
St. Jude\u2019s devices treat dangerous irregular heart rhythms that can cause cardiac failure or arrest. Implanted under the skin of the chest, the devices electronically pace heartbeats and shock the heart back to its normal rhythm when dangerous pumping patterns are detected.<\/p>\n
The company\u2019s Merlin(at)home Transmitter electronically sends details on the device\u2019s performance to a website where the patient\u2019s physician can review the information. But that device can also be hacked.<\/p>\n
The FDA\u2019s review is ongoing, agency spokeswoman Angela Stark said. Its investigation confirmed the vulnerabilities of the home transmitter, which could potentially be hacked and used to rapidly deplete an implanted device battery, alter pacing and potentially administer inappropriate and dangerous shocks to a person\u2019s heart.<\/p>\n
The software patch issued by St. Jude \u201caddresses vulnerabilities that present the greatest risk to patients,\u201d Stark said.<\/p>\n
Stark said the company is working to address remaining vulnerabilities quickly. She said any new cardiac devices submitted to the FDA for review that use the affected transmitter will not be cleared or approved without the software update.<\/p>\n
St. Jude disclosed details about the problem after it merged with Abbott. The company has previously denied findings that their devices could be hacked and filed a lawsuit against Muddy Waters LLC and MedSec, alleging that they tried to manipulate the markets to profit from the vulnerability research disclosures.<\/p>\n
The revelations about a hacker\u2019s ability to potentially gain remote access and affect even the workings of a human heart shed light on the pressing problems of cybersecurity in an increasingly networked world. The advisory also highlights the dilemma for security researchers who may feel an obligation to inform the public of possible dangers but don\u2019t want to cause unnecessary panic.<\/p>\n
\u201cYour average patient isn\u2019t going to be targeted by assassins,\u201d said Matthew Green, an assistant professor for computer science at Johns Hopkins University. He was hired by Muddy Waters to help validate the MedSec findings after St. Jude filed its lawsuit. \u201cAn attack on this level is low-probability but very high-impact.\u201d He called it \u201cprobably the most impactful vulnerability I\u2019ve ever seen.\u201d<\/p>\n
Green said many of the more severe vulnerabilities identified by MedSec for the devices themselves have not been fixed, but the new software would make the home system a little more secure.<\/p>\n
The FDA has been urging manufacturers to update their products, software and security measures since at least 2013. However, agency guidelines issued last year are not binding. The FDA does not review the vast majority of cyber security updates made to devices, under its own rules intended to streamline medical device upgrades.<\/p>\n
In 2015 the FDA issued two separate safety alerts to hospitals over drug pumps made by Hospira, now owned by Pfizer.<\/p>\n
In the second notice, regulators told hospitals to stop using the company\u2019s Symbiq Infusion System after the company confirmed the system could be remotely hacked, allowing an outside party to potentially reprogram the drug pumps. The devices are used to slowly dose intravenous drugs for pain, infection, nutrition and other uses and are usually programmed through a wireless hospital network.<\/p>\n
No patient injuries were reported in connection with the issue, but the agency urged users \u201cto begin transitioning to alternative infusion systems as soon as possible.\u201d<\/p>\n
Hospira discontinued the pumps for unrelated reasons prior to the FDA announcement, according to the agency.\u2014AP<\/p>\n
Image:\u00a0medsec.com<\/p>\n","protected":false},"excerpt":{"rendered":"
The Homeland Security Department warned Tuesday about an unusual cybersecurity flaw for one manufacturer\u2019s implantable heart devices that it said could allow hackers to remotely take control of a person\u2019s defibrillator or pacemaker.<\/p>\n","protected":false},"author":2,"featured_media":2410,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,1],"tags":[],"_links":{"self":[{"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/posts\/2409"}],"collection":[{"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/comments?post=2409"}],"version-history":[{"count":0,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/posts\/2409\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/media\/2410"}],"wp:attachment":[{"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/media?parent=2409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/categories?post=2409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kt10.khaleejtimes.ae\/index.php\/wp-json\/wp\/v2\/tags?post=2409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}